Privacy Policy
AuthDrift is built to hold as little personal data as the product allows. This page explains who is responsible for your data, what we collect, why, who helps us process it, how long we keep it, and your rights under the GDPR.
Who we are
The data controller is AuthDrift. Email [email protected] with any question or request about your data, including those described below.
What we collect
- Account data — your email address and display name, mirrored from our identity provider when you sign in, plus your account and any teammates you invite.
- Monitored domains — the domains you add, their DNS- and HTTPS-derived posture snapshots, and detected drift events.
- DMARC reports — aggregate (RUA) reports you route to AuthDrift, including the sending IP addresses they name. We ignore forensic (RUF) reports.
- Email delivery records — which alert and report emails were sent to which address, so we don't send duplicates.
- Public checks — every free public check is stored anonymously: the domain and its results, with no personal data. The only trace of the caller is a one-way keyed hash of their IP address, kept to detect abuse — it cannot be reversed to an IP.
Before October 2026 a launch waitlist collected email addresses and domains. It no longer accepts sign-ups. Those addresses are used only to reply to the people who joined and are deleted once we have replied.
Why we collect it
To run the service you asked for (GDPR Art. 6(1)(b)): authenticate you, monitor your domains, and send the drift alerts and reports you configure. Abuse protection of the public checker relies on our legitimate interest in keeping the service available (Art. 6(1)(f)). We do not sell personal data or use it for advertising.
Where it is hosted and who processes it
The AuthDrift application, its database, and our self-hosted sign-in service run on servers in the European Union. We use these subprocessors, each receiving only the data it needs:
- EU hosting provider — runs the servers that store all of the data above.
- Resend, Inc. (United States) — sends alert, report, invitation and sign-in emails. It receives recipient addresses and email content.
- Cloudflare, Inc. (United States) — DNS, CDN, and email routing for our domains. Your requests to AuthDrift, including your IP address, pass through its network.
Transfers to the United States are covered by the providers' data processing agreements, which include the EU Standard Contractual Clauses, and by the EU-U.S. Data Privacy Framework where the provider is certified.
How long we keep it
- Posture history and drift events — retained for 365 days during early access (a little longer around month-end, until that month's report is generated), then trimmed automatically.
- DMARC reports — the raw report emails are kept for 30 days; the parsed aggregates and the sending IPs they name are kept for 365 days.
- Generated reports — kept for 730 days so you can reopen past monthly reports and share links.
- Anonymous public checks — kept for 90 days.
- Deleted domains and clients — removed from monitoring immediately and purged with their history after a 30-day grace period.
- Account data — kept while your account exists; see below for deletion.
Deleting your data
An account owner can delete the entire account from Settings → Delete account. This is a hard purge: the account, its domains, snapshots, drift history, DMARC reports, reports, alert channels, members, and sessions are irreversibly deleted, and any user left with no other account is removed too. There is no recovery and no retention beyond what the law requires.
Your sign-in identity (email address and password) is held separately by our sign-in service and is not removed by this purge. To delete it as well, email [email protected] from the address you signed up with and we will remove it by hand.
Your rights
Under the GDPR you can access, correct, export, or erase your personal data, and object to or restrict its processing. The account owner can action most of this directly in the app; for anything else, email [email protected] and we will respond within one month. You also have the right to lodge a complaint with your local data protection authority.